Skip to content

Getting Started - The Preparation Phase

flowchart LR
  A["Preparation"] --> B[Initial Implementation] --> C[Ongoing Certification]

  classDef current stroke:#00A86B,stroke-width:3px;
  class A current;

Getting started with FedRAMP is intimidating. These Consolidated Rules for 2026 are designed to help folks navigate the government's expectations for cloud services and understand exactly how FedRAMP works... but it's a lot. The simple fact is that FedRAMP is one of many complex aspects of making a service available to the federal government that requires subject matter expertise and a serious time commitment.

Step by Step Preparation

This section of the site is laid out in the order that new cloud service providers should approach obtaining a FedRAMP Certification. Here is a general overall of the recommended approach:

Step What to do Learn more
1 Working with the government isn't like doing commercial business and FedRAMP is just one small part of it - you'll probably need an advisory service to help you navigate. Finding an Advisor
2 FedRAMP Certification comes in many shapes and sizes for different purposes and use cases, so you'll need to target a specific initial and ongoing FedRAMP Certification Profile based on your individual company's circumstances.

Your choice of path depends on how you got here - if you already have an Agency Sponsor that is prepared to give you a FedRAMP Rev5 Agency Certification, then your path is already set. Alternatively, FedRAMP itself can be your sponsor for FedRAMP 20x.		 Choosing a Certification Path
3 The simplest option is to start with a Class A Certification while planning to upgrade later, but some providers might have a contract for a specific FedRAMP Certification Class they'll need to shoot for. Think carefully about readiness, customer needs, and how the class affects assessment expectations before aiming too high too early - never plan to go straight to Class D. Choosing a Certification Class
4 If you're built on the cloud already and can easily deploy to FedRAMP Certified infrastructure or platforms, then you'll want to target a cloud-native FedRAMP 20x Certification. If you run your own infrastructure then you'll need to stick with a modernized FedRAMP Rev5 Certification. Choosing a Certification Type
5 Once you know your target FedRAMP Certification Profile, enter the Implementation Phase and start doing the work needed to be ready for assessment and review. This is where your team should confirm scope, address gaps, prepare evidence, and make sure the service is genuinely ready. You'll want to start applying FedRAMP rules to qualify for a listing on the FedRAMP Marketplace as soon as possible. Initial Implementation

Comments